table or view
list of users
allows the specified users to pass their privileges to other users
ON Employee
TO Manager
WITH GRANT OPTION
the user Manager can do anything to the Employee table, and can allow other users to do the same (by using GRANT statements)
GRANT SELECT, UPDATE(Salary)
ON Employee
TO Finance
the user Finance can view the entire Employee table, and can change values in its Salary column, but cannot change any other values or pass on their privilege to other users
Removing privileges
a previously granted privilege can be revoked using the following statement:
REVOKE
ON
FROM
if a user was granted the same
privilege from some other user,
then they will still keep it
all other privileges that depend on the revoked one will be revoked automatically
Admin grants ALL to Manager WITH GRANT OPTION
Admin grants SELECT to Finance WITH GRANT OPTION
Manager grants ALL to Personnel
Finance grants SELECT to Personnel
Manager revokes ALL from Personnel
Personnel still has SELECT privilege from Finance
Admin revokes SELECT from Finance
Personnel loses SELECT privilege
privileges work at the level of tables
access can be restricted by columns
access cannot be restricted by row!
views, together with privileges, allow for customised access control
a view is a table that is derived as the result of a SELECT statement
SELECT statement can then be used with views in the same way tables can
UPDATE statement can sometimes be used with views
Creating views
CREATE VIEW
AS
the name of the newly created view
a query that returns the rows and the columns of the view
we want each user to be able to view the names and phone numbers only of those employees in their own department
note: in Oracle, you can refer to the current user using the keyword USER
CREATE VIEW OwnDept AS
SELECT Name, Phone
FROM Employee
WHERE Department = (SELECT Department
FROM Employee
WHERE name = USER);
GRANT SELECT ON OwnDept TO PUBLIC;
ID Name Phone Department Salary
S123 J Evans x70320 Finance £30000
S234 L Davies x70871 Marketing £35000
S345 R Jenkins x75600 Marketing £35000
… … … … …
Views and privileges
views and privileges are combined to control access
create a view that contains the information needed
grant privileges to that view, rather than the underlying tables
views are virtual tables
their content depends on the underlying tables
we can select from views just like a table
… but what about update, insert, and delete?
Updating views
updates to the underlying tables will change the views
for a view itself to be updatable, the defining query has to satisfy the following conditions:
every element in SELECT is a column name
should not use DISTINCT
view should be defined on a single table (no JOIN, UNION, etc.)
WHERE should not have nested SELECT statements
should not use GROUP BY or HAVING
Access control with views and privileges
to restrict a user’s access to a table …
create a view of that table that shows only the information the user needs to see
grant the user privileges on the view
revoke any privileges the user has on the original table
Employee(ID, Name, Salary, Department)
we want to let the user John see Department and Name, and be able to update Department (only)
creating a view
CREATE VIEW JohnsView
AS SELECT Name, Department FROM Employee;
setting the privileges
GRANT SELECT, UPDATE(Department)
ON JohnsView TO John;
REVOKE ALL ON Employee FROM John;
Database integrity
Security vs. integrity
database security makes sure that the user is authorised to access information
database integrity makes sure that (authorised) users use that information correctly
integrity constraints:
domain constraints apply to data types
attribute constraints apply to columns
relation constraints apply to rows in a single table
database constraints apply between tables
Domains and attributes
domain constraints are data types
SQL statement: CREATE DOMAIN (note: not in Oracle)
CREATE DOMAIN Colour VARCHAR(15)
CONSTRAINT checkCol CHECK (VALUE IN (‘red’,’blue’,…);
attributes are constrained by their domains
CREATE TABLE Dress
col Colour
Assertions
assertions provide a way to specify relation and database constraints
CREATE ASSERTION CHECK ();
assertions state a Boolean condition that must always be true
no action is permitted that would make the condition false
can refer to one or several tables
often use EXISTS or NOT EXISTS
note: not supported in Oracle!
Relation constraints
to create a relation constraint we simply create an assertion that checks the given constraint
e.g. in the Employee table, no Bonus should be more than 15% of the employee’s Salary
CREATE ASSERTION checkSalaryBonus CHECK
NOT EXISTS
FROM Employee
WHERE Bonus > 0.15*Salary
Database constraints
database constraints are similar to relation constraints,
but they refer to multiple tables
e.g. given tables Student(ID, Name, Department) and Enrolment(ID, Module), make sure no computer science student takes more than 12 modules
CREATE ASSERTION CSEnrolment CHECK
NOT EXISTS
FROM Student AS S
WHERE S.Department = ‘computer science’
AND ((SELECT COUNT(*) FROM Enrolment AS E
WHERE S.ID = E.ID) > 12
Constraints in Oracle
Oracle does not support domains or assertions!
… but it does support row–level constraints using
CHECK
row–level constraints are declared like other constraints:
CONSTRAINT CHECK ();
less general than assertions since the condition refers to a single row of a single table
add a check on the Employee table to make sure no employee’s Bonus is more than 15% of their Salary
ALTER TABLE Employee
ADD CONSTRAINT checkSalaryBonus
CHECK (Bonus < 0.15*Salary);
/docProps/thumbnail.jpeg
程序代写 CS代考 加微信: cscodehelp QQ: 2235208643 Email: kyit630461@163.com